Privacy Policy

Effective 22 October 2026

Marginalia is an iPhone app for keeping track of what you read and remembering it. It is made and run by Jason Hindley ("I", "me"). This policy explains what the app stores, where it is stored, who can see it, and how to delete it.

Using Marginalia without an account

You can add books, track your progress, keep highlights and notes, look up words and ask about a book without signing in. All of it is stored only on your iPhone. None of it is sent to me.

Some features have to ask public book and dictionary services for information (see "Services the app contacts" below). Those requests contain only what is needed to answer them, such as a search term or a word, and never your name or account.

What is stored when you have an account

When you sign in with Apple or Google, the app receives:

• your email address. If you use Apple's Hide My Email, this is a relay address and I never see your real one.
• your name, if you choose to share it.
• the profile picture link your Google account provides, if you sign in with Google.
• an account identifier from Apple or Google.

If you signed in with Apple, a token from Apple is also stored so that your Sign in with Apple permission can be revoked when you delete your account. The app itself cannot read this token.

To sync across devices and make social features work, your account stores what you create in the app:

• Your profile: username, display name, bio, profile photo, member number, the date you joined, and your five favourite books.
• Your library: the books on your shelves, reading progress and page counts, reading sessions, start and finish dates, past reads, ratings, reviews, and whether a book is marked private.
• What you keep from books: highlights, notes, words you have looked up (with the sentence they came from), your Recall schedule (see "Checking in on what you read"), and flashcards made in earlier versions with their review history.
• Goals and follows: your yearly reading goal and the authors you follow.
• Asking about a book: whether you have agreed to Claude answering your questions, and how many questions and check-in replies you have sent each day.
• What Marginalia remembers: if you have Marginalia Plus and turn it on, what you choose to keep from your conversations about books, whether you have agreed to it, and whether it is paused (see "What Marginalia remembers").
• Your Marginalia: if you have Marginalia Plus and ask for it, the page Claude writes about your reading, and whether you have agreed to it (see "Your Marginalia").
• This Week in Ideas: if you have Marginalia Plus and have agreed to Your Marginalia, each week's edition Claude makes for you, and what you tell the app about its picks: a thumbs up or down, any reason you write, and whether you opened a pick or added its book (see "This Week in Ideas").
• Your other books on a passage: if you have Marginalia Plus and turn it on, what Claude finds when you keep a passage, whether you have agreed to it, and a numerical index of each passage and note you keep, made and kept by Marginalia's database host and used only to find related passages. The index is kept only while this is turned on (see "Your Marginalia").
• Marginalia Plus: whether your account has Plus, and a record of any subscription or purchase you make in the app (see "Marginalia Plus").
• Social connections: friend requests, friendships, and the accounts you have blocked.
• Photos you upload: your profile photo, any cover you choose for a book from its other editions, and cover photos of your own books taken in earlier versions of the app.

Asking about a book

You can ask questions about a book. They can be answered in two ways. Asking out loud is covered below.

By Claude. If you are signed in, questions are answered by Claude, an AI model made by Anthropic. The first time, the app explains what will be sent and asks whether you agree. Nothing is sent until you do. Your answer is stored with your account, and you can withdraw it at any time: open the Social tab, then the gear menu, then Turn Off Claude Answers. Each question goes from your iPhone to Marginalia's server, which checks that you are signed in and have agreed, then passes it to Anthropic. Anthropic does not receive your name, email address or account. Under its terms for businesses, Anthropic does not use what it receives to train its models, and deletes it within 30 days, unless it needs it for longer to enforce its usage policy or the law requires it. Marginalia's server does not store your questions or the answers. It counts how many questions each account asks each day, because there is a daily limit.

By Apple's model. On an iPhone that supports Apple Intelligence, if you are signed out or have not agreed to Claude, questions are answered by Apple's language model, which runs on your iPhone. Nothing you ask is then sent to me, to Apple or to any AI service.

To answer, either model is given your question and the conversation so far, the book's title, author, year and description, the shelf it is on, the page you have reached, and the highlights and notes you have kept from it. For a book that is not on your shelves, such as one a friend is reading, it is given only the book's details and nothing of your friend's. If you have Marginalia Plus and have turned on what Marginalia remembers, Claude is also given that (see below). Apple's model never is.

Conversations are not saved. One ends when you close it, and nothing from it is stored on your iPhone or in your account, except anything you choose to keep in what Marginalia remembers. One more thing is kept: your choice of whether spoilers are allowed, stored on your iPhone for each book. Quiz questions you kept as flashcards in earlier versions are saved like any other flashcard, and synced to your account if you have one.

You can also ask out loud. The app uses the microphone only while voice is turned on in a conversation. What you say is turned into text by Apple's speech recognition, on your iPhone where your iPhone supports it. Otherwise iOS sends the audio to Apple to be transcribed, and Apple's privacy policy applies. Audio is never recorded or stored by the app. Answers are read aloud by your iPhone's own voice.

Checking in on what you read

Recall can check in on a book you are reading or have read: Claude asks you a few questions about it, responds to each answer, and sums up how you did. It can also go over words you have looked up. Check-ins are answered only by Claude, so they need an account, and a book is checked in on only once you add it to Recall. The first time, the app explains what a check-in sends and asks whether you agree, separately from asking about a book. You can remove a book from Recall at any time, from its page or from Recall's schedule, and Turn Off Claude Answers stops check-ins as well as questions.

A check-in on a book gives Claude everything asking about it does (see above), and also your rating and review of the book, and the note Claude wrote after your last check-in on it. A check-in on words gives Claude each word, the meaning you saved for it, and the sentence and book you met it in. With what Marginalia remembers turned on, a check-in on a book is also given what it remembers about your reading, and a check-in on words what it remembers about your words. Both go through Marginalia's server to Anthropic, on the same terms as a question. Each reply you send counts towards a daily limit.

The conversation itself is not saved. Three things are kept, on your iPhone and with your account: which books you have added to Recall; how each check-in and each word went, which decides when it comes back; and a sentence Claude writes after a check-in on a book, saying what you understood and what to ask about next time, which is given to Claude at your next check-in on that book. Each of those sentences is kept with your account, not only the latest, so together they show how your understanding of a book has moved from one check-in to the next. Only the latest is given to Claude. They are deleted with the book or with your account; taking a book out of Recall keeps them, as it keeps the book's schedule. Anything you choose to keep in what Marginalia remembers is kept too.

What Marginalia remembers

With Marginalia Plus, Marginalia can remember what you have understood and where you stand, so each conversation about a book picks up from the last. At the end of a check-in, and sometimes under an answer to a question, Claude suggests what to remember: an idea you explained, where you stand on something a book argues, a change of mind, a question still open, something to come back to, or a word you have made your own. You see each suggestion, and nothing is kept unless you keep it. The first time, the app explains this and asks whether you agree.

What you keep is stored with your account: each sentence, the book and date it came from, and, where there are some, your own words from the conversation. It is given to Claude with each check-in and question, and when Your Marginalia is written, through Marginalia's server to Anthropic on the same terms as a question. Once it holds about fifty things, Marginalia can offer, at most once a week, to ask Claude how to tidy it: Claude is given what is kept and suggests what to merge or set aside, and nothing changes unless you accept it.

When something kept is reworded, by a later conversation, by a tidy or by your own edit, its earlier wording is kept with it, for you alone, and is not given to Claude. Correcting something with This Isn't Right keeps nothing of what you corrected.

You can see everything it keeps in What Marginalia Remembers, on the Social tab, and edit, correct or forget any of it, pause it, or forget everything. It is never shown to friends or anyone else. It is kept, with its earlier wordings, until you forget it or delete your account. If your Plus ends, what is kept stays and you can still forget it, but it is no longer given to Claude. Turn Off Claude Answers stops it being read or added to.

Your Marginalia

With Marginalia Plus, you can ask Claude to write Your Marginalia: a page about what your reading says about you, the ideas you keep returning to and what you have not read yet. The first time, the app explains what it sends and asks whether you agree, separately from everything else. To write it, Marginalia's server reads your shelves, with when you read each book and your ratings and reviews, your highlights and notes, Claude's notes from your check-ins, and, if it is turned on, what Marginalia remembers, and sends them to Anthropic on the same terms as a question. Books it suggests are checked against Open Library, and the ideas it names against Wikipedia, which receive only their titles.

The page is kept with your account, for you alone: not your friends, not anyone. It is written again only when you ask, at most once a week. Pages about the ideas themselves, which every reader who meets an idea shares, are written from the idea's Wikipedia article and contain nothing about you. Turn Off Claude Answers stops anything more being sent; the page already written stays until you delete your account.

When you keep a passage. With Marginalia Plus, Marginalia can also show where your other books take up the same question as a passage you have just kept, including where they disagree. The app explains it and asks whether you agree, on the same screen as Your Marginalia; if you agreed to Your Marginalia before this was added, it asks again, since this happens each time you keep a passage. Each time, Marginalia's server sends Anthropic the passage, its page and your note on it, and the passages and notes from your other books closest to it, with each book's title, author and year and your shelf and rating for it, and, if it is turned on, what Marginalia remembers, on the same terms as a question. To find the closest ones, each passage and note you keep is turned into a numerical index by Marginalia's database host; nothing outside Supabase is involved in that. Claude finds which of your passages take up the same question, and writes a heading for what they share and a sentence on each. That is kept with your account, for you alone, and deleted with the passage or with your account. The ideas it names are checked against Wikipedia, which receives only their titles. Stop Looking in Other Books, on any of these cards, or Turn Off Claude Answers stops it, and deletes the index.

This Week in Ideas

With Marginalia Plus, once you have agreed to Your Marginalia, Explore shows This Week in Ideas: a weekly edition of things to read, watch or listen to, chosen for you, each with a sentence on why. Your Marginalia's explanation, when the app asks whether you agree, covers this too. The first time you open the app in a new week, Marginalia's server makes that week's edition. It reads your shelves (each book's title, author, shelf, rating and when you read it, but not your highlights or notes), the ideas and disagreements Your Marginalia found in your reading, the questions you have left open in what Marginalia remembers if it is turned on, recent work from the authors you follow, the books your friends are reading, and the headlines of your last few editions, and sends them to Anthropic on the same terms as a question.

Your friends' books are sent without their names, so Anthropic does not learn who is reading them, and books they have marked private are left out. In the same way, if you are friends with someone who has Plus, the books on your Reading shelf that you have not marked private can be included in their edition, without your name.

Claude also searches the web for essays, talks and podcast episodes that bear on your open questions and the ideas you keep returning to. Anthropic runs those searches, with search terms Claude writes from what it was sent; they contain no name or account. Recent work from the authors you follow is found in their public feeds (a Substack, a YouTube channel, a podcast), where Wikidata records them. Before an edition is kept, Marginalia's server opens each link in it to check that it works. Books it suggests are checked against Open Library, and ideas against Wikipedia, which receive only their titles.

You can give each pick a thumbs up or down, and say in your own words what was wrong with one. That, and whether you opened a pick or added its book, is kept with your account and sent to Anthropic when your next editions are made, so they suit you better. A link you say is broken is checked again.

Each week's edition is kept with your account, for you alone, with the weeks before it. Turn Off Claude Answers stops new editions; those already made, and what you said about their picks, stay until you delete your account. Without Plus, Explore can show one recent piece from the authors you follow, found the same way; nothing is sent to Anthropic for it.

Marginalia Plus

Marginalia Plus is bought in the app, through Apple. Apple handles the payment, and Marginalia never sees your card or your Apple account. When you buy or restore it, the app sends Apple's signed record of the purchase to Marginalia's server, which checks Apple's signature and keeps it with your account: which product it is, its transaction number, whether it was a test purchase, and when it renews, expires or was refunded. Apple tells the server when a subscription renews, lapses or is refunded. Other readers can see whether you have Plus, as a mark beside your name. Deleting your account does not cancel a subscription: cancel it in your Apple account's subscriptions.

What never leaves your iPhone

• Page scans. When you scan a page to save a passage, the text is recognised on your iPhone by Apple's Live Text. The photo is not uploaded. Only the passage you choose to keep is saved.
• Motion data. The profile card tilts as you move your phone. Motion readings are used live and never stored or sent.
• Goodreads exports. If you import your library from Goodreads, the file you choose is read on your iPhone and is never uploaded. Each book in it is looked up in Open Library and Apple's iTunes Search by its title, author and ISBN. The books that are found are added to your library, with the shelves, ratings, reviews and dates the file holds for them, like any book you add yourself.
• Questions about books, when Apple's model answers them. When Claude answers, they are sent as described above. Speech recognition on an iPhone that cannot do it on the device is the other exception.

Who can see your information

• Anyone signed in to Marginalia can see your profile: username, display name, bio, photo, member number, joined date and favourite books, and whether you have Marginalia Plus. Accounts you have blocked cannot.
• Friends (only people whose friend request you have accepted, or who accepted yours) can see your shelves, ratings, reviews and highlights, and your reading goal. Anything you mark private is hidden from them. A pending request gives no access to anything.
• Only you can see your notes, vocabulary, Recall schedule and check-in notes, flashcards and review history, past reads, the authors you follow, your block list, what Marginalia remembers, Your Marginalia, This Week in Ideas and what you say about its picks, what Claude finds about the passages you keep, and your Plus purchases.

These rules are enforced by the database itself, not only by the app.

Reports and moderation

If you report a profile, review or highlight, the report stores who reported it, why, and a copy of the reported content as it was at that moment. For a profile report this includes a copy of the profile photo. Moderation needs the original, even if the content is later changed. A notification of the report is sent to a private Slack channel that only I can access. When a report has been reviewed, you are told whether the content was removed. You are not told anything more.

Profile names and bios are automatically checked against a list of prohibited words when they are saved.

Services the app contacts

These services receive requests from the app. Like any website, they can see your device's IP address.

• Supabase hosts the database, sign-in and photo storage for accounts, and makes the index used to find related passages. Data is stored in Singapore (AWS ap-southeast-1) and encrypted in transit.
• Anthropic provides Claude, which answers questions about a book, checks in on what you read, and, with Marginalia Plus, writes Your Marginalia, makes This Week in Ideas and searches the web for it, finds where your other books answer a passage you keep, and tidies what Marginalia remembers, each only if you have agreed. By way of Marginalia's server, it receives what each of those sections above describes. It does not receive your account details.
• Apple and Google handle signing in if you choose them. Their own privacy policies apply to that step. Apple also handles Marginalia Plus purchases through the App Store, and tells Marginalia's server when a subscription renews, lapses or is refunded.
• Apple's speech recognition may receive what you say when you ask about a book out loud, but only if your iPhone cannot recognise speech on the device itself.
• Open Library (Internet Archive) provides book search, book details, author pages and covers, and finds the books in a Goodreads export you import. It receives your search terms and the books being looked up.
• Apple's iTunes Search provides covers, book search results and ratings, and helps find the books in a Goodreads export you import. It receives your search terms and a book's title, author or ISBN.
• Google Books provides covers for a few books that have none elsewhere. It receives a book's ISBN.
• Wiktionary provides word definitions. It receives the word you look up.
• Wikidata provides authors' websites and social links, and where their feeds are. It receives the author being viewed or looked up.
• Substack, YouTube and Apple Podcasts provide recent work from the authors readers follow, for This Week in Ideas. Marginalia's server, not your iPhone, reads their public feeds and opens the pages they link to. They receive nothing about you. A pick you open is opened like any other link.
• Wikipedia provides an author's biography where Open Library has none, and is how the ideas in Your Marginalia, and those a passage you keep is linked to, are checked. It receives the author or idea being looked up.
• Slack receives notifications of reports, as described above.

None of these services receive your account details, except Supabase, which stores them, and Apple or Google when you sign in with them.

What Marginalia does not do

• It shows no advertising.
• It contains no analytics, tracking or advertising SDKs.
• It does not track you across other apps or websites.
• It does not sell or rent your information, or share it with anyone for their marketing.
• It does not send your reading data to an AI service unless you have agreed to the feature that sends it, and then it sends only what that feature's section above describes.
• It does not use your data to train any AI model.

How long information is kept, and deleting it

Information is kept for as long as you have an account.

You can delete your account in the app: open the Social tab, then the gear menu, then Delete account. This permanently deletes your account and everything linked to it, including your profile, library, highlights, notes, vocabulary, Recall, flashcards, what Marginalia remembers, Your Marginalia, This Week in Ideas, what Claude found about your passages and their index, your Plus purchase records, photos and friendships. If you signed in with Apple, your Sign in with Apple permission is revoked too.

One exception: reports you made or received are kept as a moderation record after the account is deleted. The link to the deleted account is removed.

Data stored only on your iPhone is deleted when you delete the app.

You can also delete individual books, highlights, notes, past reads and anything Marginalia remembers at any time, and edit your profile, reviews, notes and what Marginalia remembers.

Children

Marginalia is not directed at children under 13, and I do not knowingly collect information from them. If you believe a child has created an account, contact me and I will delete it.

Your rights

You can ask for a copy of your information, ask for it to be corrected, or ask for it to be deleted. Most of this you can do yourself in the app. For anything else, email me and I will respond within 30 days. Depending on where you live, you may also have the right to complain to your local data protection authority.

Changes to this policy

If this policy changes, the updated version will be posted here with a new effective date. If a change affects what is shared or who can see it, the app will say so before the change takes effect.

Contact

Jason Hindley
hello@jasonhindley.info